Restore PEP 740 attestations on release

FastAPI's published wheels carried signed provenance up to 0.128.0, but lost it in
the migration to uv (#14676, commit b4ba7f46). Verified against PyPI's integrity API:

  fastapi 0.127.0 -> HTTP 200 (has provenance)
  fastapi 0.128.0 -> HTTP 200 (has provenance)
  fastapi 0.129.0 -> HTTP 404 (none)   <- first release after the uv migration
  fastapi 0.139.0 -> HTTP 404 (none)   <- latest

That migration replaced `pypa/gh-action-pypi-publish` (which emits PEP 740
attestations by default for Trusted Publishing projects) with `uv publish`, whose
docs state it "does not currently generate attestations". The OIDC Trusted Publishing
identity (`id-token: write`) is still configured, so only the emission step was lost.

This keeps `uv build` and hands the upload back to gh-action-pypi-publish, restoring
attestation emission. No other change.

Co-Authored-By: Claude Fable 5 <[email protected]>

.github/workflows/publish.yml

@@ -36,4 +36,9 @@ jobs:
       - name: Build distribution
         run: uv build
       - name: Publish
-        run: uv publish
+        # gh-action-pypi-publish emits PEP 740 attestations by default under Trusted
+        # Publishing; `uv publish` does not generate them. Using it here restores the
+        # release provenance that fastapi published up to and including 0.128.0.
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        with:
+          packages-dir: dist/